Asp.net mvc 权限过滤和单点登录（禁止重复登录）

1.权限控制使用controller和 action来实现，权限方式有很多种，最近开发项目使用控制控制器方式实现代码如下

/// <summary>
/// 用户权限控制
/// </summary>
public class userauthorize : authorizeattribute
{
  /// <summary>
  /// 授权失败时呈现的视图
  /// </summary>
  public string authorizationfailview { get; set; }
  /// <summary>
  /// 请求授权时执行
  /// </summary>
  /// <param name="filtercontext">上下文</param>
  public override void onauthorization(authorizationcontext filtercontext)
  {
    // 获取url请求里的 controller 和 action
    string controllername = filtercontext.routedata.values["controller"].tostring();
    string actionname = filtercontext.routedata.values["action"].tostring();
    // 获取用户信息
    userloginbaseinfo _userlogininfo = filtercontext.httpcontext.session[property.uerloginsession] as userloginbaseinfo;
    //根据请求过来的controller和action去查询可以被哪些角色操作: 这是查询数据库 roleid使用 1,2,3,4格式
    rolewithcontrolleraction rolewithcontrolleraction =
      sampledata.rolewithcontrollerandaction.firstordefault(r => r.controllername.tolower() == controllername.tolower() && r.actionname.tolower() == actionname.tolower() && r.roleids.contails("3"));
    // 有值处理
    if (rolewithcontrolleraction != null)
    {
      //有权限操作当前控制器和action的角色id
      this.roles = rolewithcontrolleraction.roleids;
    }
    else
    {
      //请求失败输出空结果
      filtercontext.result = new emptyresult();
      //打出提示文字
      httpcontext.current.response.write("对不起,你没有权限操作!");
    }
    base.onauthorization(filtercontext);
  }
  /// <summary>
  /// 自定义授权检查（返回false则授权失败）
  /// </summary>
  protected override bool authorizecore(httpcontextbase httpcontext)
  {
    //if (httpcontext.user.identity.isauthenticated)
    //{
    //  string username = httpcontext.user.identity.name;  //当前登录用户的用户名
    //  user user = sampledata.users.find(u => u.username == username);  //当前登录用户对象
    //  if (user != null)
    //  {
    //    role role = sampledata.roles.find(r => r.id == user.roleid); //当前登录用户的角色
    //    foreach (string roleid in roles.split(','))
    //    {
    //      if (role.id.tostring() == roleid)
    //        return true;
    //    }
    //    return false;
    //  }
    //  else
    //    return false;
    //}
    //else
    //  return false;   //进入handleunauthorizedrequest
    return true;
  }
  /// <summary>
  /// 处理授权失败的http请求
  /// </summary>
  protected override void handleunauthorizedrequest(authorizationcontext filtercontext)
  {
    if (string.isnullorwhitespace(authorizationfailview))
      authorizationfailview = "error";
    filtercontext.result = new viewresult { viewname = authorizationfailview };
  }
}

 二.单点登录方式使用application方式来实现

  1.用户登录成功后记录当前信息

/// <summary>
/// 限制一个用户只能登陆一次
/// </summary>
/// <returns></returns>
private void getonline()
{
  string userid = "1";
  hashtable singleonline = (hashtable)system.web.httpcontext.current.application[property.online];
  if (singleonline == null)
    singleonline = new hashtable();
  idictionaryenumerator ide = singleonline.getenumerator();
  string strkey = string.empty;
  while (ide.movenext())
  {
    if (ide.value != null && ide.value.tostring().equals(userid))
    {
      //already login 
      strkey = ide.key.tostring();
      //当前用户已存在移除、
      singleonline.remove(strkey);
      system.web.httpcontext.current.application.lock();
      system.web.httpcontext.current.application[property.online] = singleonline;
      system.web.httpcontext.current.application.unlock();
      break;
    }
  }
  //sessionid
  if (!singleonline.containskey(session.sessionid))
  {
    singleonline[session.sessionid] = userid;
    system.web.httpcontext.current.application.lock();
    system.web.httpcontext.current.application[property.online] = singleonline;
    system.web.httpcontext.current.application.unlock();
  }
}

 2.使用actionfilter来实现单点登录，每次点击控制器都去查询过滤是否在其它地方登录

/// <summary>
 /// 用户基础信息过滤器
 /// </summary>
 public class loginactionfilter : actionfilterattribute
 {
   /// <summary>
   /// 初始化地址
   /// </summary>
   public const string url = "~/login/index?error=";
   /// <summary>
   /// 该方法会在action方法执行之前调用 
   /// </summary>
   /// <param name="filtercontext">上下文</param>
   public override void onactionexecuting(actionexecutingcontext filtercontext)
   {
     // 获取上一级url
     // var url1 = filtercontext.httpcontext.request.urlreferrer;
     userloginbaseinfo _userlogin = filtercontext.httpcontext.session[property.uerloginsession] as userloginbaseinfo;
     // 用户是否登陆
     if (_userlogin == null)
     {
       filtercontext.result = new redirectresult(url + "登陆时间过期,请重新登陆!&url=" + filtercontext.httpcontext.request.rawurl);
     }
     else
     {
       filtercontext.httpcontext.session.timeout = 30;
     }
     //判断是否在其它地方登录
     hashtable singleonline = (hashtable)system.web.httpcontext.current.application[property.online];
     // 判断当前sessionid是否存在
     if (singleonline != null && !singleonline.containskey(httpcontext.current.session.sessionid))
       filtercontext.result = new redirectresult(url + "你的帐号已在别处登陆，你被强迫下线!");
     base.onactionexecuting(filtercontext);
   }
   /// <summary>
   /// 执行后
   /// </summary>
   /// <param name="filtercontext"></param>
   public override void onresultexecuting(resultexecutingcontext filtercontext)
   {
     //记录操作日志，写进操作日志中
     var controllername = filtercontext.routedata.values["controller"];
     var actionname = filtercontext.routedata.values["action"];
     base.onresultexecuting(filtercontext);
   }

 3.用户正常退出或则非正常退出处理当前用户信息销毁session

/// <summary>
/// session销毁
/// </summary>
protected void session_end()
{
  hashtable singleonline = (hashtable)application[property.online];
  if (singleonline != null && singleonline[session.sessionid] != null)
  {
    singleonline.remove(session.sessionid);
    application.lock();
    application[property.online] = singleonline;
    application.unlock();
  }
  session.abandon();
}

以上所述是小编给大家介绍的asp.net mvc 权限过滤和单点登录（禁止重复登录），希望对大家有所帮助